Oj - CraftedSignal Threat Feed

Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent (CVE-2026-54896)

hello@craftedsignal.io — Fri, 19 Jun 2026 19:57:25 +0000

The oj Ruby gem, specifically its Oj.dump function in object serialization mode, is affected by a heap buffer overflow vulnerability, identified as CVE-2026-54896. This flaw impacts all versions of the gem that include the ext/oj/dump.h component, up to and including version 3.17.1. The vulnerability occurs when an application attempts to serialize an Exception object using Oj.dump with a particularly large :indent value (e.g., 5000). The underlying C implementation pre-allocates a buffer based on the object's attributes but fails to account for the substantial additional memory required by the indent string, leading to repeated writes beyond the buffer's boundary. This memory corruption can result in application crashes, denial of service, or potentially enable arbitrary code execution. Defenders should prioritize patching and validating oj gem versions in their Ruby applications.

Attack Chain

Initial Input: An attacker sends crafted JSON input to a vulnerable application that utilizes the oj gem.
Object Deserialization: The application processes the attacker's input using Oj.load in object mode, which creates a Ruby Exception object (e.g., RuntimeError) from the JSON.
Vulnerable Serialization Call: A legitimate application component subsequently attempts to serialize this Exception object back to JSON using Oj.dump, with an excessively large :indent value (e.g., 5000), which might be attacker-controlled or a misconfigured application setting.
Insufficient Buffer Allocation: Internally, Oj.dump (specifically dump_obj_attrs) allocates a memory buffer for the serialization output, but this buffer's size is based on the object's attributes and does not adequately account for the combined size of the large indentation strings.
Heap Buffer Overflow: The fill_indent function is repeatedly called during serialization to add indentation. When writing the large indent string (e.g., 5000 bytes) into the pre-allocated buffer, it exceeds the available space.
Memory Corruption and Impact: This repeated out-of-bounds writing causes a heap buffer overflow, corrupting adjacent memory. This typically leads to a denial of service through an application crash or, in more advanced scenarios, could be leveraged for arbitrary code execution.

Impact

The primary impact of CVE-2026-54896 is memory corruption, leading to the affected Ruby application crashing and resulting in a denial of service. If an attacker can reliably control the execution flow after the overflow, it could potentially be escalated to remote code execution. Although no specific victim counts or targeted sectors have been disclosed, any Ruby application utilizing the oj gem in a manner that deserializes untrusted input and subsequently reserializes Exception objects with large indent values is at risk.

Recommendation

Patch CVE-2026-54896: Immediately upgrade the oj gem to version 3.17.2 or later to mitigate CVE-2026-54896.
Implement Application-Level Controls: Developers should ensure that user-controlled input does not dictate the :indent parameter for Oj.dump calls and avoid using excessively large hardcoded indent values.
Deploy Sigma Rules: Deploy the provided Sigma rules to your SIEM solution to detect abnormal ruby process terminations or crash dump creations, which may indicate exploitation attempts.
Enable Process Monitoring: Ensure robust process creation and termination logging is enabled for Ruby applications (e.g., Sysmon on Windows, Auditd on Linux) to capture potential crash-related events.

Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close

hello@craftedsignal.io — Fri, 19 Jun 2026 19:56:18 +0000

A critical heap use-after-free vulnerability, identified as CVE-2026-54897, affects the Oj::Doc iterators within the oj Ruby gem. Specifically, the each_value, each_child, and each_leaf methods are vulnerable. The issue arises when a Ruby block, executed during the iteration process, makes a reentrant call to doc.close or d.close on the document or one of its child nodes. This premature closing operation frees the associated heap memory while the underlying C iterator in ext/oj/fast.c is still active. Upon returning from the Ruby block, the C code attempts to access memory that has already been deallocated, leading to a use-after-free condition. This vulnerability, present in all oj gem versions utilizing ext/oj/fast.c (confirmed up to v3.17.1), can be triggered from pure Ruby code and results in application instability, crashes, or potential arbitrary code execution. Organizations running Ruby applications that parse JSON via the oj gem are at risk.

Attack Chain

A Ruby application integrates and uses the oj gem for JSON data processing.
The application opens a JSON document for parsing using the Oj::Doc.open method.
The application initiates an iteration over the document's elements using a vulnerable iterator method such as each_value, each_child, or each_leaf, providing a Ruby block for processing.
During the execution of the yielded Ruby block, a call is inadvertently made to doc.close or d.close on the Oj::Doc instance or one of its child nodes.
This close operation triggers the ruby_sized_xfree function within the ext/oj/fast.c source, leading to the premature deallocation of the underlying heap memory buffer associated with the Oj::Doc object.
Control returns from the Ruby block to the original C iterator function in ext/oj/fast.c (e.g., doc_each_child).
The C iterator attempts to access or dereference pointers (like cur->next) that point to the heap memory region which was previously freed in step 5.
This access to deallocated memory results in a use-after-free condition, manifesting as application crashes, segmentation faults, or unpredictable program behavior.

Impact

The primary impact of CVE-2026-54897 is application instability and denial-of-service via crashing. Applications utilizing the vulnerable oj gem can be forced to terminate unexpectedly, leading to service disruption. Depending on the memory layout and the specific memory contents at the time of the use-after-free, this vulnerability could potentially be exploited for arbitrary code execution, though this has not been specifically detailed in the advisory. This could compromise the integrity and confidentiality of data processed by the Ruby application. Any Ruby application that handles untrusted JSON input and uses the vulnerable oj gem iterations is at risk.

Recommendation

Upgrade the oj gem to version 3.17.2 or later immediately to patch CVE-2026-54897.
Review application code for instances where doc.close or d.close might be called reentrantly within Oj::Doc iterator blocks, as described in the overview.
Deploy the Detects Ruby Process Access Violation (Windows) Sigma rule to monitor for unusual crashes in Ruby applications.
Deploy the Detects Ruby Process Segmentation Fault (Linux) Sigma rule to monitor for crashes in Ruby applications on Linux systems.